Facebook Adds SPDY Support!

Facebook has quietly enabled support for SPDY, the super charged HTTP replacement from Google that is serving as the basis for HTTP/2.0. This is a huge leap forward for web performance and the adoption of newer, better protocols to transmit web content. Wider adoption of SPDY means that the need for web performance hacks like domain sharing disappears, and more exposure to SPDY increases the chances of discovering and resolving security issues, such as the recent SSL/SPDY CRIME attack.

Back in July 2012, Facebook posted to HTTP Working Group that they interested in the development of an HTTP/2.0 based on SPDY. Furthermore, Facebook stated they that (emphasis added):

We currently are implementing SPDY/v2, due to the availability of
browser support and the immediate gains we expect to reap. Although
we have not run SPDY in production yet, our implementation is almost
complete and we feel qualified to comment on SPDY from the
implementor’s perspective. We are planning to deploy SPDY widely at
large scale and will share our deployment experiences as we gain them.

Since SPDY was transitioning from an interesting experiment to mainstream protocol I went looking for tools to validate that a SPDY-enabled web server is working properly. Surprisingly, getting SPDY working on a site is a fairly involved process. No tools existed to help debug this process so I created SPDYCheck and launched a hosted version at SPDYCheck.org in October.

SPDYCheck is a online tool that verifies the many different things a website must do to support SPDY. SPDYCheck also tests a test for best practices which ensures SPDY is used whenever possible, such as automatically redirecting HTTP traffic to HTTPS to leverage a SPDY connection.

Running SPDYCheck on Facebook in October 2012 revealed something odd. They had all the infrastructure in place to support SPDY. Specifically they had deployed SSL, were using valid X.509 certificates, and had implemented the Next Protocol Negotiation (NPN) extension, in its ServerHello message during the SSL handshake. This allows them to advertise alternative protocols like SPDY to browsers that support them. However Facebook was not actually telling the browser that it supported SPDY. As I noted at the time:

Facebook has put all the infrastructure for SPDY support in place, but has not flipped the switch to tell browsers to use SPDY! It’s possible that Facebook is conducting a controlled experiment and only allowing SPDY for certain website visitors.

Even as late as December 2012, Facebook still was not offering SPDY support.

SPDY Support is a Go!

I’m not sure exactly when SPDY support was turned on. Oddly I can find no public announcement about this, especially so given the amount ofpresscoverage for Facebook even mentioning they were interested in HTTP/2.0 and SPDY. I managed to find this image uploaded by Varun Kumar on February 1 2013, showing that Facebook’s CDN hostname *.fbcdn.net was serving static resources like images and JavaScript via SPDY. It is possible that I am just part of an A/B test that Facebook is running to slowly roll out SPDY. However I have done this test from multiple different datacenters, without being logged into Facebook, and am getting the same results. The chance that I’m in the same “SPDY On” A/B test group across multiple systems is low. Instead it seems that Facebook is now using SPDY to serve content to potentially a significant majority of its 1 billion plus users!

This is almost better than adding support to their desktop site. This is because the network conditions for mobile devices present a number of challenges to delivering content over HTTP. SPDY’s multiplexing of requests and responses over a single TCP connection is far more resilient and efficient for mobile devices than dozens of short lived HTTP connections, especially with TCP’s slow start and congestion control features. In fact, Mike Belshe recently showed Amazon’s homepage loading twice as quickly on a mobile device using SPDY instead of HTTP. Half of all traffic to Facebook is now coming from mobile devices, so enabling SPDY for their mobile site could be a huge win.

SPDY Support in Mobile

Of course, SPDY supporting web servers is only half the battle. While I have written on SPDY’s support among desktop browsers in the past, I have not looked at SPDY support among mobile browsers. Right now, only experimental versions of Chrome for Android support SPDY. Update: My mistake, a quick look at CanIUse shows many more mobile browsers supporting SPDY. Amazon’s Silk browser, built into its Kindle Fire line of Tablets support SPDY, but only between Amazon’s systems and your tablet, and only when using their browser accelerator feature. No browser support SPDY exist for iOS devices. Apple requires that all browsers use Safari’s HTML rendering engine via UIWebView. It’s unclear whether a SPDY subsystem can be added under this to transmit the actual content, or how much work that would be. I think it’s telling that Chrome on iOS does not have SPDY support.Update: Thanks to Ilya Grigorik and the others who wrote in to tell me that Chrome only leverages iOS’s HTML layout/rendering libraries. It includes the same networking subsystem as Chrome/Chromium, which includes SPDY support. Given how good SPDY support is for mobile, and the benefits of SPDY over a HTTP on a mobile connection, I hope more mobile sites deploy SPDY modules as quickly as possible.

Conclusions

I am thrilled that Facebook has finally enabled SPDY support. Back in October I found it odd that Facebook had everything needed for SPDY but had not flipped the switch (in fact, I had to add a separate test case into SPDYCheck that looked for NPN Extensions that did not advertise SPDY support). Wider adoption of protocols like SPDY help pave the way for everyone to have faster websites.

If you are interested in adding SPDY support, be sure to check out SPDYCheck.org to help you debug and validate the various steps needed to have a SPDY-enabled website. Want a faster website? SPDY support is just one of over 400 performance enhancements that Zoompf checks when analyzing your website. Get a free performance scan of you website today, and for deeper project based analysis take a look at our Zoompf WPO product.